Hide Forgot
Description of problem: If one sets up PolicyKit rules to allow non-root users to manage virtual machines, then when creating a new storage pool (directory based) via virsh pool-define-as, then the new storage pool directory is created with owner and group still as root, and not the user that virt-manager is running under. As a result, that user can't use the storage pool just created for new VMs. Version-Release number of selected component (if applicable): libvirt-client-0.8.7-18.el6_1.4.x86_64 How reproducible: Everytime Steps to Reproduce: 1. Create the file /etc/polkit-1/localauthority/50-local.d/50-virt.pkla with the following contents to allow non-root users to run virt-manager: [Allow all users libvirt management permissions but require password] Identity=* Action=org.libvirt.unix.manage ResultAny=auth_self_keep ResultInactive=auth_self_keep ResultActive=auth_self_keep 2. As a non-root user create a new storage pool: virsh --connect qemu:///system "pool-define-as jgu-vmstore --type=dir --target=/scratch/virt/jgu/images ; pool-build jgu-vmstore ; pool-start jgu-vmstore ; pool-autostart jgu-vmstore" 3. Examine ownership of the directory just provisioned as a storage pool: $ ls -ldZ /scratch/virt/jgu/images drwx------. root root unconfined_u:object_r:default_t:s0 /scratch/virt/jgu/images Actual results: See above Expected results: I would expect the owner and group of the directory to be set to the user running virsh, rather than root. More info on the use case for this: http://stuckinadoloop.wordpress.com/2012/02/13/multi-user-use-of-virt-manager/
From reading your blog, it looks like you're now using pool-define and passing the user and group in the XML, which is the right thing to do in this situation. I understand that the behavior of pool-define-as was surprising to you, but that's the way it's intended to work. pool-define gives you the full control that you're looking for. If you believe that this behavior should be changed, you should take this discussion to the upstream libvirt list, as the community might be willing to take patches to implement the behavior you want.
I think what's actually missing is that the pool-define-as command should really have --owner and --group options. But yes, more of an upstream thing, agreed.